

i 

AIAA 2002-3581 

/ 

Understanding and Resolution of the 
Block 2 SSME, STS-104 Engine Shutdown 
Pressure Surge In-Flight Anomaly 

William D. Greene and Michael H. Kynard 
NASA Marshall Space Flight Center 
Huntsville, AL 


38th AIAA/ASME/SAE/ASEE 
Joint Propulsion Conference & Exhibit 
7-10 July 2002 / Indianapolis, IN 


For permission to copy or republish, contact the American Institute of Aeronautics and Astronautics 
1801 Alexander Bell Drive, Suite 500, Reston VA 20191 


AIAA 2002-3581 


Understanding and Resolution of the Block 2 SSME, 

STS-104 Engine Shutdown Pressure Surge In-Flight Anomaly 

William D. Greene and Michael H. Kynard 
■NASA Marshall Space Flight Center, Huntsville, AL 

} 

I 

Abstract 

STS-104, launched July 2001, marked the first flight of a single Block 2 Space Shuttle Main 
Engine (SSME). This new configuration of the SSME is the culmination of well over a decade 
of gradual engine system upgrades. The launch and mission were a success. However, in the 
process of post-launch data analysis a Main Propulsion System (MPS) anomaly was noted and 
tied directly to the shutdown of the Block 2 SSME. An investigation into this anomaly was 
organized across NASA facilities and across the various hardware component contractors. This 
paper is a very brief summary of the eventual understanding of the root causes of the anomaly 
and the process whereby an appropriate mitigation action was proposed. An analytical model of 
the High Pressure Fuel Pump (HPFP) and the low pressure fuel system of the SSME is presented 
to facilitate the presentation of this summary. The proposed mitigation action is discussed and, 
with the launch of STS- 108 in November 2001, successfully demonstrated under flight 
conditions. 


Nomenclature 




Acronvms 


Symbols 

ET 

External Tank 

b. 

Frictional damping coefficient 

HPFP 

High Pressure Fuel Pump 

J 

b 

Viscous damping coefficient 

HPFTP 

High Pressure Fuel 

V 

- 


Turbopump 

Ef 

Frictional energy losses 

HPFTP/AT 

Advanced Technology High 

J 

Moment of inertia 


Pressure Fuel Turbopump 

M 

Moment (general) 

LPFD 

Low Pressure Fuel Duct 

M t 

Turbine power moment 

LPFP 

Low Pressure Fuel Pump 



MFV 

Main Fuel Valve 


Torque coefficient 

MPS 

Main Propulsion System 

P 

Density 

SSME 

Space Shuttle Main Engine 

a 

Rotational velocity 

STS 

Space Transportation System 
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Introduction 

On 12 July 2001, Space Shuttle Mission STS- 
104 erupted from the pad at the NASA 
Kennedy Space Center. At the back of the 
Shuttle Orbiter Atlantis, as always, three 
Space Shuttle Main Engines (SSMEs) guided 
the orbiter into space.j What was different for 
this flight was that or/e of those engines was of 
a new configuration/ SSME unit number 2051 
was the first Block 2 ^engine mounted and 
fired on the shuttle. 

This was a watershed event in the quarter 
century history of the SSME project in that it 
represented the culmination of decades of 
design, test, redesign, intermittent starts and 
stops, and finally resounding success. The 
Block 2 SSME contains nearly all of the 
accumulated component improvement projects 
undertaken over the years including: 

• Two Transfer Tube Phase 2+ Powerhead 

• Single-Tube Heat Exchanger 


• Large Throat Main Combustion Chamber 

• Advanced Technology High Pressure 
Oxidizer Turbopump 

• Advanced Technology High Pressure Fuel 
Turbopump (HPFTP/AT) 

It is the last component listed above, the 
HPFTP/AT, that marked the final piece in the 
puzzle in the transition to the Block 2 engine. 
The design, development, and certification of 
this component undertaken by Pratt & 

Whitney in coordination with the NASA 
SSME Project Office took nearly a decade to 
complete. The final product of that process is 
a piece of hardware that is considerably more 
robust and potentially safer than its 
predecessor. 

The first flight of the Block 2 SSME was, for 
the most part, pleasingly uneventful. The pre- 
start chill was nominal. The start transient and 
thrust buildup was nominal. Flight ascent 
(mainstage) operation was nominal. The 
throttling for the maximum aerodynamic loads 



Figure 1 . STS- 104 Fuel System Post-Shutdown Pressures 
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and maximum vehicle acceleration was 
nominal. And, finally, engine shutdown after 
512 seconds of hot fire was nominal. Almost. 

The engineers examining the SSME flight 
data made the initial observation of the 
anomaly almost immediately. During the 
engine shutdown pha$e, about 10 seconds past 
engine shutdown contmand, it was noted that 
the pressure at the erfgine inlet and the 
pressure in the low pressure fuel duct were 
elevated for one engine. The magnitude of the 
peak was approximately 80 psia. Compared 
to the other two engines, both of which had 
peak pressures during the same time period in 
the vicinity of 65 psia, this stood out. The 
engine with the higher pressure was the Block 
2 SSME. These pressure rises in the low 
pressure fuels ducts are illustrated in Figure 1. 

Within the engine community, a differential 
pressure of approximately 15 psi was little 
more than a curiosity. Considering that 
elements in this particular subsystem 
experience pressures over 200 psia during 
operation and that certain components of the 
SSME experience pressures of over 7000 psia, 
it was understandably difficult to generate a 
great deal of excitement over 15 psi. The 
difference was attributed to an unforeseen yet 
benign integration difference due to the new 
HPFTP/AT. Within the engine system, there 
was no issue. 

However, a concern was registered within the 
Main Propulsion System (MPS) integration 
community and only a couple of days later 
this pressure rise became categorized as an In- 
Flight Anomaly. In response, a team was 
formed across NASA and industry elements, 
and an investigation was launched. 

Understanding the Problem 

The root cause of the concern expressed by 
the engineers concerned with the MPS and the 
Orbiter can be traced within the simplified 


schematic of the MPS fuel system in Figure 2. 
During mainstage operation, the 17-inch 
disconnect valve, the three engine pre- valves, 
and the Main Fuel Valves (MFVs) within the 
engines are all open in order to feed fuel to the 
combustion chambers of the engines. During 
the engine shutdown sequence and the 
sequence that leads to separation of the 
Orbiter from the External Tank (ET), the 
valves close in this order: 

• First the engine MFVs close to kill 
power to the engine. 

• The orbiter pre- valves close to isolate 
the engines from the MPS. 

• The 17-inch disconnect valve closes to 
prepare for ET separation. 

• A dump valve opens to drain 17- 
manifold. 

The pressure within the low pressure fuel 
systems of the engines (the three upper traces 
in Figure 1) start to rise upon closure of the 
pre- valves, approximately 6.5 seconds, 
because at that point there is a quantity of 
cryogenic liquid trapped between the pre- 
valves and the MFVs. Within that trapped 
volume of liquid both the Low Pressure Fuel 
Pump (LPFP) and the High Pressure Fuel 
Pump (HPFP) are still spinning imparting 
energy into the liquid. Further, there is a good 
bit of hardware within this system to re-chill 
back down to saturated low pressure fuel 
temperatures. This too adds energy into the 
liquid. A trapped cryogenic volume with 
energy input is an obvious way to create a 
pressure rise. 

The pressure rise observed in the 17-inch 
manifold (the single lower curve in Figure 1) 
occurs upon closure of the 17-inch disconnect 
valve at approximately 10 seconds. Here 
again the valve closure sequence has created a 
trapped volume of cryogenic liquid, this time 
between the pre- valves and the 17-disconnect 
valve. The difference, however, is that there 
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are no spinning down pumps embedded within 
this volume. So the question becomes, why 
does the pressure rise within the 17-inch 
manifold? 

The answer to that question can be found 
within the details of how the engine pre-valves 
function. Built into these valves is a 
redundant pressure relief system designed to 


protect against over pressurization of the 
engine feedlines. Thus, the very high pressure 
seen within the Block 2 SSME low pressure 
fuel system, over 80 psia, caused this relief 
system to operate and flow was initiated from 
the engine back up and into the trapped 
volume within the 17-inch manifold. Thus, 
the pressure continued to rise until the dump 
valve was activated. The pressure in the 17- 
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inch manifold reached a peak of 43 psia, the 
highest pressure observed in the history of the 
Shuttle flight program. 

That is how and why the pressure rose. Why 
it was a concern for the MPS and Orbiter 
engineers has to do with the fact that the 17- 
inch manifold has a rtfiaximum operating 
pressure of 55 psia. J*f 43 psia was achieved 
with just one Block h. SSME, what pressure 
would be achieved with three pre- valves 
relieving back into tlte manifold? The relief 
mechanism of the pre- valves is not controlled 
to tight tolerances in design or fabrication. 
What would have happened if the pre- valve in 
this case had relieved at a higher rate? Or had 
begun to relieve at a lower pressure? Taking 
these factors into consideration, it is quickly 
apparent that a number of plausible scenarios 
could be constructed in which the peak 
pressure within the 17-inch manifold exceeds 
its maximum operating pressure. 

The final piece to the puzzle can be found 
within Figure 2. The 17-inch manifold has a 
single, non-redundant relief valve. While 
relief valve failures are rare, they are not 
inconceivable. Thus, there are a number of 
plausible scenarios for the development of 
high pressure and there is a single piece of 
hardware upon which the system must depend 
for protection. The system utilized in this 
manner is not “single fault tolerant,” meaning 
that with the failure of a single component to 
operate properly there exists the possibility of 
catastrophic results. 

It is a fundamental precept within the Shuttle 
program that vehicle systems remain single 
fault tolerant. This is why the STS- 104 
pressure surge became the subject of an in- 
depth investigation and why mitigation was 
necessary to ensure safety for future flights of 
the Space Shuttle. 


Formulation of a Simple Model 

Because the root cause of the entire 
investigation can be traced back to the 
generation of pressure within the low pressure 
fuel system during the engine shutdown 
sequence, an analytical model of this 
phenomenon is a useful tool for understanding 
the situation and ultimately for finding an 
appropriate resolution. 

Figure 3 Representation of HPFP Rotor for 
Simple Model 

The primary focus here is the spindown of the 
HPFP. The primary reason for this is that the 
change in the HPFP represents the only 
significant hardware configuration change 
between the Block 2 SSME and its 
predecessor, the Block 2a SSME. Figure 3 
shows a simplistic representation of the 
spinning rotor. The other significant change 
had to do with a valve sequence change and is 
discussed below. 

The basis for the model of the HPFP is the 
conservation of angular momentum as 
represented by the following equation: 

YjM =M T +JQ.-b v Q. 2 -b f Q. = 0 (1) 
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Figure 4. Simple Model Configuration of System Volumes 


Where: 

M T Represents the turbine moment. 

j£l Represents the rotor inertia. 

b v Q. 2 Represents the viscous damping. 

b f Q Represents the frictional losses. 

Multiplying through Equation (1) by the 
HPFP speed yields the following, which is 
essentially the same equation but transformed 
to an expression of conservation of energy: 

M T Q. + -—(jQ. 2 )- x ¥pQ.'-E f = 0 ( 2 ) 

2 dt 

Where: 

Represents the turbine power. 

Represents the change in rotor 
angular energy. 


vj>p£ 2 3 Represents the viscous damping 

transformed into an expression 
of pumping energy via the 
Torque Coefficient. 

E Represents the frictional energy 

losses. 

Further simplifications can be made if it is 
assumed that the time of interest is exclusively 
after closure of the engine MFV. First, that 
simplifies the Torque Coefficient to a constant 
value since it is normally a function of the 
pump flow coefficient. Next, because this 
point is several seconds into the shutdown 
sequence, it is assumed that there is no power 
input from the turbine. Thus, Equation (2) 
becomes: 

(ja 2 )= l f'pQ 3 +£, (3) 

2 dt x ' f 

This expression simply states that the loss of 
energy of the rotor is equal to the energy 


M T Q 





imparted to the fluid, the pumping energy, and 
the energy imparted to the hardware via 
friction. This equation is useful because the 
HPFP speed from the flight data and the 
constant Torque Coefficient for no-flow 
conditions is known. 

The next consideration for the creation of a 
simple model is the system into which the 
HPFP delivers its energy. Figure 4 is a 
schematic of this system. There are, 
essentially, two volumes to consider. First, 
there is the volume on the engine side of the 
interface between the Pre- Valve and the MFV. 
Second, there is all the rest of the volume 
represented primarily by the 17-inch manifold. 
Further, within the engine volume there are 
liquid and vapor portions. The vapor is 
created by the HPFP energy input into the 
liquid. In typical rocket engineering parlance, 
this growing gas volume is the “boil-out” of 
the pump. 

The final element of this model comes in the 
form of heat transfer. Again, preferring to 
keep this model as simple as possible, it is 
assumed that there is a constant, low-level 
heat transfer into the engine volume during the 
timeframe of interest. Also, there exists heat 


transfer in the form of soak back from the 
hardware of the energy listed in Equation 3 as 
frictional energy losses. Due to the 
complexities of the HPFP internal 
configuration, a straightforward, linear 
relationship was assumed and the transfer 
coefficient was determined empirically. 

Results From the Simple Model 

The focus of the analysis to be presented here 
is the Block 2 engine since this will be the 
sole engine configuration used for flight as of 
April 2002. Figure 5 shows the results from 
the simple model for the reconstruction of 
both the pressure in the low pressure fuel duct 
of the engine and the pressure in the 17-inch 
manifold for STS- 104, Main Engine 2 (the 
Block 2 SSME). The implied assumption 
used here is that the observed pressure rise in 
the 17-inch manifold was due exclusively to 
the flow back across the pre-valve from this 
one engine. 

As can be seen in Figure 5, the simple model 
does an excellent job of reconstructing the 
flight data. The data inputs required to 
generate this reconstruction are the spindown 
traces for both the LPFP and the HPFP. 



Low pressure 
fuel duct 


17-inch manifold 


time from shutdown (s) 


Figure 5. STS- 104 Block 2 SSME Flight Data and Simple Model Reconstruction 



It should be noted that despite the relatively 
good results from this simple model shown 
here, a much more detailed and 
comprehensive multiple- volume model was 
used for the actual reconstruction and 
mitigation action selection process during the 
investigation. This model was originally 
constructed by engineers at NASA Marshall 
Space Flight Center ahd later codified and 
documented by engineers at Boeing 
Huntingdon Beach. 

Investigation Team Mandate 

A team was formed to understand and resolve 
this anomaly. This team was comprised of the 
technical experts from each of the orbiter MPS 
subsystems drawn from both NASA and 
contractor organizations. The team was 
assembled on July 17, and given a mandate to 
come to the shuttle program with a mitigation 
action on August 30. This deadline was the 
latest that any changes could be effected for 
the launch of STS- 108 scheduled for 
November. The team’s mandate was clear: 
understand the root cause of the pressure rise, 
be capable of re-creating it using an analytical 
model, and provide the best mitigation action 
along with rationale for its selection. 

The team first gathered all necessary data on 
the orbiter and SSME systems in question. 
This was done to completely understand the 
characteristics of the system as well as the 
subsystem interactions. A complete history of 
the operations of this system was compiled 
and thoroughly examined in order to 
completely understand the problem. As 
mentioned above, an analytical model was 
constructed to represent the actions of the 
system in the timeframe of interest. Once the 
model was mature, it would not only duplicate 
the pressure rise on STS- 104, but also be able 
to predict effectiveness of mitigation plans. 


Problem Resolution Process 

The team then turned its attention to the 
resolution of the anomaly. In order to develop 
a plan for mitigation of this effect a number of 
proposed, “brainstormed” ideas were bounced 
against the realities of cost and launch 
schedule constraints. Obviously the best 
solution would be to build the hardware such 
that the pre- valve relieved in a more 
predictable and controlled manner or build the 
17-inch manifold such that it was capable of 
withstanding higher pressure surges. 
Alternatively, a redundant relief valve could 
be added to the 17-inch manifold thereby 
eliminating the single point failure potential of 
the current configuration. However, 
considering the cost and launch schedule 
impacts of wholesale changes to the main 
propulsion systems for the entire orbiter fleet, 
all such orbiter hardware solutions were 
necessarily stillborn. They would only be 
called upon only when all other alternatives 
were exhausted. 

On the other side of the interface, a number of 
suggestions were made as to how the engine 
hardware might be altered to minimize the 
post-shutdown pressure generation. The new 
Block 2 HPFTP/AT could possibly be 
reconfigured to spindown more like the older 
version of the HPFTP used on Block 2a. 
Perhaps the low pressure fuel duct could be 
built in such a way that it provided a pressure 
surge accumulator analogous to the POGO 
accumulator on the liquid oxygen side of the 
engine. While changes to engine hardware are 
not impossible to implement, as evidenced by 
the Block 2 SSME itself, they take several 
years and hundreds of millions of dollars to 
bring to flight-ready fruition. Again, 
hardware changes would only be considered 
after all other reasonable alternatives were 
explored. 
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Figure 6. Post-Shutdown Valve Sequence Representation 


So, with hardware options out of the picture 
with regard to reasonable considerations, there 
is no choice but to turn to software and 
operational sequence changes with the hope 
that this is a sufficient tool to get the job done. 

This then leads to a discussion of success 
criteria. Or, in other words, what is good 
enough? It was decided, at minimum, because 
the 17-inch manifold has a maximum 
operating pressure of 55 psia, that nowhere in 
the system should a pressure value exceed this 
value prior to opening of the dump valve. 
Thus, even with substantial Pre- Valve relief 
coupled with a 17-inch manifold relief valve 
failure, there would be no possibility of 
exceeding the 17-inch manifold maximum 
operating pressure. A look back at Figure 1 
highlights the fact that it was not only the 
Block 2 SSME low pressure fuel duct pressure 
that violated this criterion. Indeed, a historical 
review of all Shuttle data to date reveals that 
such a criterion has never been met across any 
of the previous SSME configurations. The 
Block 2 SSME data merely represents an 
extreme case that functioned to bring this case 


to the attention of the propulsion system 
community. 

When it comes to engine shutdown the 
manifestation of software influence can be 
summarized by the valve sequence. Figure 6 
is a representation of the shutdown valve 
sequence discussed earlier for previous 
incarnations of SSME and for the new Block 2 
SSME. It can be seen that the order of the 
sequence has not changed with three valves 
closing, Main Fuel Valve (MFV), Pre-Valve 
(Pre-V), and the 17-inch Disconnect Valve 
(17” Disc), followed by the opening of the 
dump valve. The only change is the time span 
between MFV and Pre-Valve closures. 

An examination of Figure 5, specifically the 
trace of pressure in the low pressure fuel 
system of the engine reveals that the pressure 
rise does not occur until the Pre-Valve is 
closed. Yet the flow of liquid hydrogen 
comes to a stop when the MFV is closed. 

Thus the time span in between represents a 
period within which there is energy input into 
the stagnant fluid from the spinning pumps 
and yet the fluid volume is uncontained. What 
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one finds is that during this time span gas is 
being formed in the two fuel pumps, 
particularly in the HPFP. Later, when the Pre- 
Valve is closed it is hypothesized that this 
volume of gas acts as an accumulator to help 
absorb the onslaught of additional energy 
input into the closed volume. 

i 

Figure 7 shows several output traces from the 
simple model using STS- 104 data as input. 
The highest trace is the reconstructed pressure 
data for the low pressure fuel duct. The trace 
labeled “MFV closure earlier” represents what 
would happen if the MFV closure time for the 
Block 2 SSME was moved back to where it 
had been for previous SSME configurations. 
The resulting peak pressure prior to the dump 
valve opening just after 12 seconds is reduced 
from the reconstructed flight data as would be 
expected based upon the discussion above 
relative to the formation of a gas accumulator. 
However, this peak still exceeds the 55 psia 
criterion. 

A more radical suggestion would be to move 
the closure of the MFV out past the time of 
the Pre-Valve closure. In other words, close 


the Pre-Valve first and then close the MFV. 
While this is a fundamental change to the 
valve sequence order, the idea of providing a 
time period for gas accumulator growth prior 
to locking up the system remains the same. In 
Figure 7 the trace labeled “MFV closure later” 
represents the resulting pressure rise in the 
low pressure fuel duct when the MFV closure 
is delayed until 1.3 seconds beyond Pre-Valve 
closure. The value of 1.3 seconds was chosen 
as a demonstration example since that was the 
previous time span between MFV closure and 
Pre- Valve closure for previous configurations 
of SSME. The resulting peak pressure is 
significantly lower than the STS- 104 flight 
reconstruction but still higher than the goal. 

Before any more effort is expended on the 
issue of altering the MFV closure time it 
should be noted that such a change is not 
trivial technically or programmatically. It 
would require some level of development and 
recertification testing. With regard to the 
notion of moving the MFV closure time 
earlier, this ignores the fact that the MFV 
closure was changed for the Block 2 SSME 
with the intention of reducing the 



STS- 104 Reconstruction 
MFV closure earlier 
MFV closure later 

Pre-Valve closure later 


Figure 7. Simple Model Demonstration of Proposed Software Mitigation Options 
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environments within the new HPFTP/AT 
during shutdown. Changing the closure time 
back to its previous position may compromise 
specifically those hardware life issues that the 
Block 2 SSME was intended to address. Plus, 
according to the modeling results, it would not 
fulfill the success criterion. 

1 

With regard to the notion of moving the MFV 
closure to a point after Pre- Valve closure, the 
ramifications of this change could be 
significant. While it would likely be possible 
to delay the MFV closure long enough to 
achieve the stated goal in peak pressure 
reduction, what this change might do to the 
turbopumps is unclear. Further, there would 
be more liquid hydrogen dumped through the 
engine system than there is currently. The 
effects of this both in terms of the engine 
hardware and in terms of the vehicle are also 
unclear. In short, this change introduces a 
whole bevy of unknowns. In the world of 
operational systems, unknowns typically 
translate to time and money, and perhaps lots 
of both. 


The other software alternative, referring again 
to the timeline in Figure 6, would be to delay 
closure of the Pre-Valve. Unlike the MFV 
changes, this suggestion is not isolated to the 
SSME but requires a change to the Orbiter 
Main Propulsion System software. 

Ideally, what one would want to do is: 

1. Increase the amount of time available to 
build the gaseous accumulator. 

2. Decrease the time between system lock up 
and the opening of the dump valve. 

These two objectives could be achieved 
simultaneously by shifting the Pre- Valve 
closure to later and keeping everything else 
the same. Unfortunately, due to the intricacies 
of the Orbiter software system and the 
necessary procedures between engine cutoff 
and ultimately separating from the expendable 
External Tank, this cannot be accomplished 
precisely. Instead, there does exist the 
possibility of delaying the entire sequence 
starting with the Pre- Valve closure. In other 
words, it is possible to slide the whole Orbiter 
valve schedule to the right. This scenario is 


1 .3 seconds 



2.6 seconds 

Figure 8. Proposed Valve Sequence Timeline Compared to Original Sequence Prior to Block 2 
SSME 
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presented in timeline form in Figure 8. Here 
the Pre-Valve closure has been delayed by 2 
seconds resulting in the closure of the 17-inch 
Disconnect Valve and the opening of the 
Dump Valve to also be delayed by 2 seconds. 
Further, this delay propagates all of the way 
through separation of the External Tank so 
that it too would be delayed by 2 seconds. 

) 

The result in terms c/F pressure rise trace in the 
low pressure fuel duct is illustrated in Figure 7 
and labeled as “Pre-Valve closure later.” The 
peak pressure at the time of the opening of the 
Dump Valve, now at just after 14 seconds, is 
below the 55 psia criterion goal. This 
scenario, assuming that it could be 
implemented on Shuttle, represents the best 
option to mitigate the pressure surge in the 
low pressure fuel duct of the SSME thereby 
safeguarding the 17-inch Manifold. It also 
provided the solution with the least impact to 
the Orbiter propulsion system. 

Mitigation Demonstration: STS- 108 

The next opportunity to launch a Block 2 
SSME after STS- 104 came in November 2001 
with STS-108. Due in part to the issue of the 
shutdown pressure rise observed on STS- 104, 
it was decided to again fly with only a single 
Block 2 SSME but only-if an appropriate 
pressure surge mitigation action had been 
identified and implemented. 

STS- 104 launched in mid-July. The best 
option for mitigating the pressure surge as 
discussed in the section above, delaying the 
valve sequence by 2 seconds, was identified 
by the investigation team by the end of August 
in fulfillment of the investigation team 
mandate. What is not discussed here is the 
fact that there are many different modes of 
SSME shutdown and vehicle contingency 
abort scenarios and all of these had to be 
addressed, explored, and analyzed prior to 
accepting the proposed mitigation action as 


the recommendation for flight. All of this 
analysis was accomplished prior to the end of 
August deadline. 

Next comes the implementation of the 
recommendation. Just in terms of scheduling, 
getting the necessary software change into the 
Shuttle system in time to support the 
November launch of STS-108 was a 
Herculean task. However, prior to that, 
analyses had to be performed by the vehicle 
flight mechanics engineers to access the 
consequences of delaying External Tank 
separation by 2 seconds. 

Thanks to the truly outstanding efforts of the 
entire Shuttle support crew including NASA, 
Boeing, Pratt & Whitney, United Space 
Alliance, and Lockheed Martin, the necessary 
evaluations were completed and STS-108 was 
cleared to fly with the next Block 2 SSME and 
with the proposed pressure surge mitigation 
action. The only identified consequences of 
the 2 second External Tank separation delay 
were some very small changes to the 
probabilities for Orbiter re-contact for some 
abort operation modes. These changes were 
deemed to be not statistically significant for 
STS-108. Later, generic analyses were 
conducted to demonstrate that there was little 
or no impact for all future flights. 

Figure 9 shows the results from the STS-108 
mission. Plotted are the predicted pressure 
trace from the simple model derived above 
with the 2-second Pre-valve closure delay and 
the actual flight data for the pressure in the 
low pressure fuel duct of the Block 2 SSME. 

It can be seen that the prediction and the 
actual data essentially fall on top of each 
other. Also shown are the peak pressure from 
STS- 104 and the goal for STS-108 so that it 
can be confirmed that the mitigation action 
taken did indeed accomplish what was 
necessary. 
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time from shutdown (s) 


Figure 9. STS- 108, Predicted and Actual Pressure in the Low Pressure Fuel Duct 


Discussion 

One question that was asked during the 
investigation and not yet addressed here was 
this: How did this integration issue slip 
through the cracks? The Block 2 SSME went 
through a rigorous evaluation process that 
included years of development testing, 
certification testing, and analytical modeling 
efforts in an attempt to avoid precisely the 
kind of surprises that occurred on STS- 104. 

One reason that this potential issue was 
missed relates back to the fact that even on 
previous configurations of SSME there existed 
pressure surges in flight as seen in Figure 1. 
Never before was much attention paid to this 
fact since there were only rare and low level 
instances of pressurization of the 17-inch 
manifold. The Block 2 SSME configuration 
did not create the issue, it only amplified the 
effects to the point of bringing them to the 
attention of the engineering corps. 


Further, this pressure surge effect is not 
apparent in the ground test data. For neither 
the Block 2 SSME or for previous SSME 
configurations do the ground test results show 
pressure surges anywhere near those seen in 
flight. As opposed to the 30 to 50 psi surge 
changes seen in flight, on the ground a typical 
surge is on the order of 1 to 5 psi and this is 
independent of SSME configuration. Until 
this investigation was conducted into the STS- 
104 anomaly, no analysis was applied to 
understand why this was the case. It was 
simply attributed to flight effects and 
considered benign. 

Qualitatively, there are three reasons why the 
SSME ground test data does not exhibit post- 
shutdown pressure surges. 

First, the volume of the ground test system 
upstream of the engine interface is 
significantly larger than on the Orbiter. The 
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larger volume acts as a larger pressure 
accumulator even when filled with liquid. 
Further, there exists the possibility of some 
volume of trapped gas within the facility 
between the Pre-Valve and the engine 
interface. Obviously this would only enhance 
the accumulator effect. 

i 

Second, due to convobtive heat transfer effects 
and afterburning in die nozzle present only on 
ground test shutdowns, there is significantly 
more power delivered to the turbines during 
the time period of interest. While it may be 
counterintuitive to suggest that higher turbine 
power translates to lower pressure surges, here 
again the gas accumulator effect dominates. 

And third, the timing of the Pre- Valve closure 
has always been different than that which is 
used in flight. The closure time is 
approximately 7.9 seconds after shutdown as 
opposed to 6.5 seconds for STS-104 and 
previous flights. Due to the acknowledgement 
of the other inherent deficiencies in modeling 
the shutdown transient, no attempt was made 
on the test stand to precisely simulate Pre- 
Valve closure in flight. 

The bottom line result from all of this 
discussion as to the differences between flight 
and ground test is the realization that the STS- 
104 anomaly was not predicted because the 
ground test data could not set off the alarms to 
suggest that a previously benign but never- 
analyzed curiosity could be transformed into a 
significant flight issue. Needless to say, this 
was a dramatic lesson for everyone involved. 

Conclusions 

The Space Shuttle flight STS-104 represented 
a significant milestone in the history of the 
Shuttle and SSME programs. The 
implementation of the Block 2 SSME is an 
enhancement to the safety and reliability of 
the vehicle. However, an unforeseen anomaly 


during engine shutdown tempered the post- 
flight celebration. In response to this anomaly 
an investigation team was formed, hardware 
characteristics were examined, analytical 
models were constructed, mitigation actions 
were explored, and finally the best action was 
recommended. All of this work was 
accomplished in a timely manner so that only 
four months later the next flight of the Block 2 
SSME, STS- 108, was a rousing success 
including a lull demonstration of anomaly 
mitigation. 

This paper has presented a discussion of the 
anomaly and its potential consequences. An 
approach to the construction of an analytical 
model was derived and compared to the flight 
data. A synopsis of the options for mitigation 
was presented along with the final choice and 
the results from that decision. And finally, a 
brief discussion of the broader lessons learned 
has been presented including the need to 
understand to some degree even those 
phenomena in the flight and ground test data 
considered benign. Unless you understand 
why something is benign, you cannot know 
under what conditions its status might change. 
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